dhi.io/dotnet
.NET 8.x SDK
8-sdk, 8-sdk-debian, 8-sdk-debian13, 8.0-sdk, 8.0-sdk-debian, 8.0-sdk-debian13, 8.0.425-sdk, 8.0.425-sdk-debian, 8.0.425-sdk-debian13
sha256:9bfe54bb00fb6fb4482281a88a95fb71b98a9c062d427dcea5adc85259eddd19
Manifest digest:sha256:6e92a50fbd0d2c8c4e1f8ed3c947b4369cd5509ec0fbd408c96d23318429591b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:8-sdk2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:8-sdk --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:5bbff9e66134cab3e3cfda96a7f0cfb3460bef59bbaaf7aca4a5cc634af32bb9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:a0efa5042229b97cc7c4db5bb2ab64759df91e88b426c85e0cea42fbefd787a7 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:e66a29ac034567ad17a2a0efcc531a74b243551b795a6b933ebdad19e68538d9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:df4309deb71c068bca660ff967fe74d8042e437cd5220a28114eb9b63815efe8 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:2e5c1c0d9f34b06b2fa1737653262d3f3c4e634c2a76b2e51fb8a5fa97657b04 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:eed52d510541462d6c893fa95765bdfc173aa83ab707fc6da8c2c1216f3f5f7b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:a20c4ec358785cadb38ae50b36be469c0ced01f8c1b57880edb097e889b5e59e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:7d6dc3e9d54a3f4a29978fd6c7cdfc2e748633926209eda97357c5e8c0a7a06f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:730b3da979c2c6325c88b03f346c59542d1d8d4cf9d5a6e1594294f93e1bcdc7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:d6a396bdfd296acdb9a678ff55853a7210484acd615877a78ba11f8d519bf8dc |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:3ec3f5c4a9ab934ac590350f52c70e830f3a16b488544de74f6831d4c6542541 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:64b03bc71bd57dcef01907f570c9d30a05b74d443eafd9947344c1ea691e6070 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:f17586207a3a2ced52cc0c1740bd27f0bbc5d9e2bc8f63a683590fbd8b4a5116 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:786adca8890719dad4535f3ad65d3415ad1736cda2d8c06611dcbf87cb2e57d9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:5bd177bac11d832897fcb3693ab05bd757f7262c30acee34c2965463d819d6f5 |